Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, Docker

>> All right. Can we start? All right, >> All right. Can we start? All right, there you go. there you go. there you go. Um hey everyone, welcome. Um hey everyone, welcome. Um hey everyone, welcome. Uh I hope everyone's enjoying the Uh I hope everyone's enjoying the Uh I hope everyone's enjoying the conference. This is uh a really fun conference. This is uh a really fun conference. This is uh a really fun conference. I've enjoyed all the talks conference. I've enjoyed all the talks conference. I've enjoyed all the talks and the presents here. and the presents here. and the presents here. Okay, so we're going to talk about Okay, so we're going to talk about Okay, so we're going to talk about unlocking agent autonomy and what that unlocking agent autonomy and what that unlocking agent autonomy and what that means. These last years have been crazy. means. These last years have been crazy. means. These last years have been crazy. I'm sure you all felt it, right? Like 2 I'm sure you all felt it, right? Like 2 I'm sure you all felt it, right? Like 2 years ago we were talking about chatbots years ago we were talking about chatbots years ago we were talking about chatbots and here we are. and here we are. and here we are. We're now in this world where We're now in this world where We're now in this world where we all see the autonomy we get from we all see the autonomy we get from we all see the autonomy we get from agents. Agents have become powerful and agents. Agents have become powerful and agents. Agents have become powerful and they'll continue being so. they'll continue being so. they'll continue being so. Um Um Um at this point, the next big challenge at this point, the next big challenge at this point, the next big challenge like we spent the last 2 years trying to like we spent the last 2 years trying to like we spent the last 2 years trying to make agents more intelligent and make agents more intelligent and make agents more intelligent and powerful and that'll keep going and I powerful and that'll keep going and I powerful and that'll keep going and I think we're almost there. I think the think we're almost there. I think the think we're almost there. I think the next challenge in front of us is next challenge in front of us is next challenge in front of us is actually harder and more important, actually harder and more important, actually harder and more important, which is how to make them safer. At this which is how to make them safer. At this which is how to make them safer. At this point, I don't think intelligence is the point, I don't think intelligence is the point, I don't think intelligence is the next big blocker for us to leverage next big blocker for us to leverage next big blocker for us to leverage agents. It is actually how to do so agents. It is actually how to do so agents. It is actually how to do so safely so we can give them all the safely so we can give them all the safely so we can give them all the access and autonomy they need. access and autonomy they need. access and autonomy they need. Just as a story, this is a small Just as a story, this is a small Just as a story, this is a small anecdote. I'm sure everyone here has anecdote. I'm sure everyone here has anecdote. I'm sure everyone here has some version of this. Um some version of this. Um some version of this. Um this is one of many agents I run. This this is one of many agents I run. This this is one of many agents I run. This runs every night. It looks at some repos runs every night. It looks at some repos runs every night. It looks at some repos I care about and you know, just does I care about and you know, just does I care about and you know, just does some analysis for me. What activities some analysis for me. What activities some analysis for me. What activities happen, who's been doing what, what happen, who's been doing what, what happen, who's been doing what, what progress has been made. Um I have others progress has been made. Um I have others progress has been made. Um I have others that might do some more, might analyze that might do some more, might analyze that might do some more, might analyze the code review comments, have some of the code review comments, have some of the code review comments, have some of my own analysis in there, be like, what my own analysis in there, be like, what my own analysis in there, be like, what was the tone, who did what, how were was the tone, who did what, how were was the tone, who did what, how were they acting? I'm a manager. This is not they acting? I'm a manager. This is not they acting? I'm a manager. This is not meant for public views, just meant to meant for public views, just meant to meant for public views, just meant to help me keep a pulse. But still, it's help me keep a pulse. But still, it's help me keep a pulse. But still, it's not something I want shared. It's for my not something I want shared. It's for my not something I want shared. It's for my own knowledge, something to keep up.

own knowledge, something to keep up. own knowledge, something to keep up. This agent has been running for weeks This agent has been running for weeks This agent has been running for weeks just fine. Runs every night, sends me an just fine. Runs every night, sends me an just fine. Runs every night, sends me an email, I look at it. email, I look at it. email, I look at it. Randomly one day, uh it decided to post Randomly one day, uh it decided to post Randomly one day, uh it decided to post this report as a PR on the repo. Why? this report as a PR on the repo. Why? this report as a PR on the repo. Why? Nothing's changed, just the model Nothing's changed, just the model Nothing's changed, just the model decided to be helpful. Um so decided to be helpful. Um so decided to be helpful. Um so >> [laughter] >> [laughter] >> [laughter] >> Thank you. Um >> Thank you. Um >> Thank you. Um But this is a fundamental thing, right? But this is a fundamental thing, right? But this is a fundamental thing, right? Like agents do stuff. They try to be Like agents do stuff. They try to be Like agents do stuff. They try to be helpful. They increase and change the helpful. They increase and change the helpful. They increase and change the goal they're doing. Either cuz they goal they're doing. Either cuz they goal they're doing. Either cuz they themselves are just trying to be themselves are just trying to be themselves are just trying to be helpful, or they get confused, they make helpful, or they get confused, they make helpful, or they get confused, they make a mistake, or they get prompt injected, a mistake, or they get prompt injected, a mistake, or they get prompt injected, right? right? right? Um Um Um This is a simple example, honestly. Like This is a simple example, honestly. Like This is a simple example, honestly. Like it's easy to fix this. That agent should it's easy to fix this. That agent should it's easy to fix this. That agent should never have had write access to GitHub. never have had write access to GitHub. never have had write access to GitHub. It should have just had read access, and It should have just had read access, and It should have just had read access, and that's an easy fix. Um that's an easy fix. Um that's an easy fix. Um But it's not that simple, right? That's But it's not that simple, right? That's But it's not that simple, right? That's a very easy case. Let's take Let's take a very easy case. Let's take Let's take a very easy case. Let's take Let's take another example. Let's imagine I have an another example. Let's imagine I have an another example. Let's imagine I have an agent, and I'm asking it to do agent, and I'm asking it to do agent, and I'm asking it to do investigate a latency spike. Check out investigate a latency spike. Check out investigate a latency spike. Check out latency spike. Great, it starts. It's latency spike. Great, it starts. It's latency spike. Great, it starts. It's looking at the logs. looking at the logs. looking at the logs. It sees, "Oh, I think there's another It sees, "Oh, I think there's another It sees, "Oh, I think there's another service here. I want the logs to for service here. I want the logs to for service here. I want the logs to for that service. Let me get that access."

that service. Let me get that access." that service. Let me get that access." "Oh, I see this uh might be related to a "Oh, I see this uh might be related to a "Oh, I see this uh might be related to a recent check-in. I would like access to recent check-in. I would like access to recent check-in. I would like access to GitHub, to the repos, to read the recent GitHub, to the repos, to read the recent GitHub, to the repos, to read the recent commits." commits." commits." Uh this looks like it may have happened. Uh this looks like it may have happened. Uh this looks like it may have happened. Let me look at Slack conversations to Let me look at Slack conversations to Let me look at Slack conversations to see has there been any chatter about see has there been any chatter about see has there been any chatter about this to learn from there. this to learn from there. this to learn from there. Great, it asked for Slack access. Great, it asked for Slack access. Great, it asked for Slack access. These are all reasonable steps, right? These are all reasonable steps, right? These are all reasonable steps, right? This makes sense. This is what I would This makes sense. This is what I would This makes sense. This is what I would expect an engineer to do. expect an engineer to do. expect an engineer to do. But what's happening is that each time But what's happening is that each time But what's happening is that each time as it's expanding its goal, expanding as it's expanding its goal, expanding as it's expanding its goal, expanding what it's doing, what it's doing, what it's doing, it's crossing the trust boundary. It's it's crossing the trust boundary. It's it's crossing the trust boundary. It's increasing the scope of the task. And increasing the scope of the task. And increasing the scope of the task. And this is fundamentally where we run into this is fundamentally where we run into this is fundamentally where we run into trouble. How do we know it's okay to trouble. How do we know it's okay to trouble. How do we know it's okay to give it access? We now end up with an give it access? We now end up with an give it access? We now end up with an agent that has access to everything at agent that has access to everything at agent that has access to everything at the same time, and so anything becomes a the same time, and so anything becomes a the same time, and so anything becomes a vector where the blast radius expands. vector where the blast radius expands. vector where the blast radius expands. This is fundamentally the big difference This is fundamentally the big difference This is fundamentally the big difference we're running into and the big we're running into and the big we're running into and the big challenge. Earlier, traditional software challenge. Earlier, traditional software challenge. Earlier, traditional software was deterministic, you could define the was deterministic, you could define the was deterministic, you could define the permissions. But now as agents become permissions. But now as agents become permissions. But now as agents become autonomous um autonomous um autonomous um and they gain and they try to solve more and they gain and they try to solve more and they gain and they try to solve more problems, what they're doing changes at problems, what they're doing changes at problems, what they're doing changes at runtime. The access they need changes at runtime. The access they need changes at runtime. The access they need changes at runtime.

runtime. runtime. And right now we haven't truly solved And right now we haven't truly solved And right now we haven't truly solved this. We haven't solved how to give them this. We haven't solved how to give them this. We haven't solved how to give them exactly the access they need, exactly the access they need, exactly the access they need, how to do this in a safe manner, how to how to do this in a safe manner, how to how to do this in a safe manner, how to know if it's correct. And this is the know if it's correct. And this is the know if it's correct. And this is the fundamental thing I think we have to go fundamental thing I think we have to go fundamental thing I think we have to go solve now solve now solve now to actually unlock autonomy. And so we to actually unlock autonomy. And so we to actually unlock autonomy. And so we go away from like can it do this to like go away from like can it do this to like go away from like can it do this to like should it do this and how do we give it should it do this and how do we give it should it do this and how do we give it that access? Also, this is something we can't just Also, this is something we can't just rely on the next frontier agent being rely on the next frontier agent being rely on the next frontier agent being really good and not making a mistake. really good and not making a mistake. really good and not making a mistake. We're going to use more than one model. We're going to use more than one model. We're going to use more than one model. I just think fundamentally we're all I just think fundamentally we're all I just think fundamentally we're all already there, I think. No one is going already there, I think. No one is going already there, I think. No one is going to bet everything on a single model or to bet everything on a single model or to bet everything on a single model or even a single frontier lab. You'll use even a single frontier lab. You'll use even a single frontier lab. You'll use models from different frontier labs as models from different frontier labs as models from different frontier labs as they make progress. And importantly, we they make progress. And importantly, we they make progress. And importantly, we will all use open models. We're all will all use open models. We're all will all use open models. We're all living through the GLM 5.2 living through the GLM 5.2 living through the GLM 5.2 um um um uh amazing progress last few weeks. And uh amazing progress last few weeks. And uh amazing progress last few weeks. And this is just the start, but there'll be this is just the start, but there'll be this is just the start, but there'll be more and more of this. So we'll end up more and more of this. So we'll end up more and more of this. So we'll end up wanting to use different models for wanting to use different models for wanting to use different models for different reasons. different reasons. different reasons. Privacy, cost, etc. So we need a Privacy, cost, etc. So we need a Privacy, cost, etc. So we need a solution that runs across them and solution that runs across them and solution that runs across them and doesn't just rely on the model itself doesn't just rely on the model itself doesn't just rely on the model itself being good.

being good. being good. We'll also use multiple harnesses. You We'll also use multiple harnesses. You We'll also use multiple harnesses. You won't just use a single harness from a won't just use a single harness from a won't just use a single harness from a single provider. One, you should like single provider. One, you should like single provider. One, you should like betting entirely on a harness betting entirely on a harness betting entirely on a harness from a frontier lab makes it hard for to from a frontier lab makes it hard for to from a frontier lab makes it hard for to get choice across models from labs and get choice across models from labs and get choice across models from labs and across open models. across open models. across open models. Two, there'll be harnesses for different Two, there'll be harnesses for different Two, there'll be harnesses for different use cases. Right now we're all very use cases. Right now we're all very use cases. Right now we're all very focused on coding, but we're going to focused on coding, but we're going to focused on coding, but we're going to expand. expand. expand. Uh the open claw moment happened, but Uh the open claw moment happened, but Uh the open claw moment happened, but it's still not landed fully, right? You it's still not landed fully, right? You it's still not landed fully, right? You can imagine sales people, marketing can imagine sales people, marketing can imagine sales people, marketing people having claws running doing stuff. people having claws running doing stuff. people having claws running doing stuff. So the kind of harnesses and agents will So the kind of harnesses and agents will So the kind of harnesses and agents will use will grow and you'll build your own. use will grow and you'll build your own. use will grow and you'll build your own. So we need something that works across So we need something that works across So we need something that works across harnesses and works across models. harnesses and works across models. harnesses and works across models. Um and we need something that it just Um and we need something that it just Um and we need something that it just doesn't just depend on no mistake doesn't just depend on no mistake doesn't just depend on no mistake happening, happening, happening, but constrains the environment around but constrains the environment around but constrains the environment around it. So what we want is an environment where the agent runs, an environment where the agent runs, where something goes wrong, there's where something goes wrong, there's where something goes wrong, there's limited blast radius, and we only give limited blast radius, and we only give limited blast radius, and we only give the access it needs, and we do this in a the access it needs, and we do this in a the access it needs, and we do this in a safe and correct manner.

safe and correct manner. safe and correct manner. We think the best way to do this is to We think the best way to do this is to We think the best way to do this is to create a runtime. Is to have a runtime create a runtime. Is to have a runtime create a runtime. Is to have a runtime that all agents run on. So, this runs that all agents run on. So, this runs that all agents run on. So, this runs across any agent, any harness, and across any agent, any harness, and across any agent, any harness, and across models. And that's where we across models. And that's where we across models. And that's where we create these uh create these uh create these uh uh artifact these these capabilities uh artifact these these capabilities uh artifact these these capabilities that we want. that we want. that we want. There are three core pillars here. There are three core pillars here. There are three core pillars here. First is containment. You need to create First is containment. You need to create First is containment. You need to create an environment where it's controlled an environment where it's controlled an environment where it's controlled what the agent can get. Um this does what the agent can get. Um this does what the agent can get. Um this does mean sandboxes. And look, you can like mean sandboxes. And look, you can like mean sandboxes. And look, you can like throw a rock and find many sandbox throw a rock and find many sandbox throw a rock and find many sandbox something at this point, but it's more something at this point, but it's more something at this point, but it's more than that. than that. than that. So, when you have a you have a sandbox So, when you have a you have a sandbox So, when you have a you have a sandbox in which you can you run the agent and in which you can you run the agent and in which you can you run the agent and it gets only what it needs. And it gets only what it needs. And it gets only what it needs. And importantly, you run the agent inside importantly, you run the agent inside importantly, you run the agent inside the untrusted boundary, and you run the untrusted boundary, and you run the untrusted boundary, and you run controls outside, so outside of the VM controls outside, so outside of the VM controls outside, so outside of the VM boundary. boundary. boundary. Second, you scope access. Second, you scope access. Second, you scope access. This is more than just what network can This is more than just what network can This is more than just what network can you access, or even what tool can you you access, or even what tool can you you access, or even what tool can you access. access. access. But you need to give actual scoped But you need to give actual scoped But you need to give actual scoped capabilities. So, in our example, capabilities. So, in our example, capabilities. So, in our example, the agent now wants to access Slack to the agent now wants to access Slack to the agent now wants to access Slack to search for any conversations around this search for any conversations around this search for any conversations around this incident.

incident. incident. Well, I could give it read only to Well, I could give it read only to Well, I could give it read only to Slack, but that's still more than what I Slack, but that's still more than what I Slack, but that's still more than what I want to give it. want to give it. want to give it. Maybe there's a single channel with only Maybe there's a single channel with only Maybe there's a single channel with only conversation with the incident, that's conversation with the incident, that's conversation with the incident, that's great. Often times that's not the case. great. Often times that's not the case. great. Often times that's not the case. It could be spread across many channels It could be spread across many channels It could be spread across many channels or a team channel with other or a team channel with other or a team channel with other conversation and I don't want this agent conversation and I don't want this agent conversation and I don't want this agent to get access to other content. How do I to get access to other content. How do I to get access to other content. How do I do this? do this? do this? The upfront predefined tools typically The upfront predefined tools typically The upfront predefined tools typically don't aren't that fine scoped. What what don't aren't that fine scoped. What what don't aren't that fine scoped. What what the runtime should do is maybe create a the runtime should do is maybe create a the runtime should do is maybe create a just-in-time tool that composes over just-in-time tool that composes over just-in-time tool that composes over existing Slack MCV tools or anything existing Slack MCV tools or anything existing Slack MCV tools or anything else, but restricts access to just else, but restricts access to just else, but restricts access to just conversations about the incident. And conversations about the incident. And conversations about the incident. And that's what the agent gets access to. that's what the agent gets access to. that's what the agent gets access to. We create and use and instead of having We create and use and instead of having We create and use and instead of having a big sandbox that we keep adding a big sandbox that we keep adding a big sandbox that we keep adding capabilities to, take that part, run it capabilities to, take that part, run it capabilities to, take that part, run it in a scoped sandbox for that task with in a scoped sandbox for that task with in a scoped sandbox for that task with just the scoped capability it needs. just the scoped capability it needs. just the scoped capability it needs. This now starts to build the runtime and This now starts to build the runtime and This now starts to build the runtime and fabric for us where we can give agents fabric for us where we can give agents fabric for us where we can give agents fine-scoped access, fine-scoped access, fine-scoped access, break down work into tasks across break down work into tasks across break down work into tasks across security boundaries, run those in security boundaries, run those in security boundaries, run those in contained sandboxes with just access contained sandboxes with just access contained sandboxes with just access they need.

they need. they need. This feels much better and now we're This feels much better and now we're This feels much better and now we're getting to place where we can be safer, getting to place where we can be safer, getting to place where we can be safer, but we're still not done cuz the core a but we're still not done cuz the core a but we're still not done cuz the core a what access should you get? If this is what access should you get? If this is what access should you get? If this is asking for Slack, is that correct? Um if asking for Slack, is that correct? Um if asking for Slack, is that correct? Um if it's asking to read this read from the it's asking to read this read from the it's asking to read this read from the Slack channel or have write access to Slack channel or have write access to Slack channel or have write access to something, should that be allowed? How something, should that be allowed? How something, should that be allowed? How do you differentiate between what is do you differentiate between what is do you differentiate between what is correct, where it's making a mistake or correct, where it's making a mistake or correct, where it's making a mistake or being incorrectly eager, or where it's being incorrectly eager, or where it's being incorrectly eager, or where it's being prompt injected? This is where we being prompt injected? This is where we being prompt injected? This is where we have to This is what intent-based access have to This is what intent-based access have to This is what intent-based access becomes. We need to understand the becomes. We need to understand the becomes. We need to understand the user's intent or the task intent, take user's intent or the task intent, take user's intent or the task intent, take the context in in account, and then the context in in account, and then the context in in account, and then decide what access you get and how that decide what access you get and how that decide what access you get and how that should be run in which contained should be run in which contained should be run in which contained environment. environment. environment. And so that becomes the next big And so that becomes the next big And so that becomes the next big challenge for us to do, which is how do challenge for us to do, which is how do challenge for us to do, which is how do we safely evolve the capabilities the we safely evolve the capabilities the we safely evolve the capabilities the task gets. So in this example, it makes task gets. So in this example, it makes task gets. So in this example, it makes sense. Okay, investigating this sense. Okay, investigating this sense. Okay, investigating this incident, you're asking for read access incident, you're asking for read access incident, you're asking for read access to Slack for that incident. That seems to Slack for that incident. That seems to Slack for that incident. That seems rational. Let's do Let's do that. All of rational. Let's do Let's do that. All of rational. Let's do Let's do that. All of a sudden, you would like email access. a sudden, you would like email access. a sudden, you would like email access. Why? Nothing about the prompt said you Why? Nothing about the prompt said you Why? Nothing about the prompt said you should have that, so I'll deny that or should have that, so I'll deny that or should have that, so I'll deny that or I'll raise it up for human approval. But I'll raise it up for human approval. But I'll raise it up for human approval. But do this not just space in the frontier do this not just space in the frontier do this not just space in the frontier lab of the model that's running, but do lab of the model that's running, but do lab of the model that's running, but do this independent running at like a this independent running at like a this independent running at like a control layer in in the in the control control layer in in the in the control control layer in in the in the control sandbox layer in the core governance sandbox layer in the core governance sandbox layer in the core governance aspect independent across all models and aspect independent across all models and aspect independent across all models and all harnesses.

all harnesses. all harnesses. This is sort of This starts to get us to This is sort of This starts to get us to This is sort of This starts to get us to a world now where we can actually have a a world now where we can actually have a a world now where we can actually have a runtime layer runtime layer runtime layer and run agents safely and run agents safely and run agents safely in a contained manner with scoped access in a contained manner with scoped access in a contained manner with scoped access and now deal with the dynamic aspect of and now deal with the dynamic aspect of and now deal with the dynamic aspect of this. this. this. And to be clear, look, this is a hard And to be clear, look, this is a hard And to be clear, look, this is a hard problem. It's not fully solved yet, but problem. It's not fully solved yet, but problem. It's not fully solved yet, but this is the world I think we have to this is the world I think we have to this is the world I think we have to move towards. move towards. move towards. But we're not done once we do this, cuz But we're not done once we do this, cuz But we're not done once we do this, cuz if you're building a runtime, not only if you're building a runtime, not only if you're building a runtime, not only does it have to provide the safety does it have to provide the safety does it have to provide the safety aspects you need, it also has to meet um aspects you need, it also has to meet um aspects you need, it also has to meet um our functional aspects. our functional aspects. our functional aspects. The runtime needs to follow the work. The runtime needs to follow the work. The runtime needs to follow the work. This can't just be something that runs This can't just be something that runs This can't just be something that runs locally or only in the cloud. It needs locally or only in the cloud. It needs locally or only in the cloud. It needs to go wherever we work, wherever agents to go wherever we work, wherever agents to go wherever we work, wherever agents work, and that's going to be everywhere. work, and that's going to be everywhere. work, and that's going to be everywhere. We'll work locally, we'll have agents We'll work locally, we'll have agents We'll work locally, we'll have agents running in the cloud, we'll do running in the cloud, we'll do running in the cloud, we'll do orchestration across clouds, we'll run orchestration across clouds, we'll run orchestration across clouds, we'll run them in our own VPC or in the customer's them in our own VPC or in the customer's them in our own VPC or in the customer's VPC as need be. The runtime has to be VPC as need be. The runtime has to be VPC as need be. The runtime has to be omnipresent and be able to move uh omnipresent and be able to move uh omnipresent and be able to move uh across all these environments. And across all these environments. And across all these environments. And ideally, it should be connected by a ideally, it should be connected by a ideally, it should be connected by a fabric, and so you can move agents up fabric, and so you can move agents up fabric, and so you can move agents up and down as you need to do.

Docker spent the last Everyone knows Docker spent the last Everyone knows Docker. I'm going to assume everyone Docker. I'm going to assume everyone Docker. I'm going to assume everyone knows Docker has used Docker. And you knows Docker has used Docker. And you knows Docker has used Docker. And you know it's the containers, and what know it's the containers, and what know it's the containers, and what Docker solved the last decade is Docker solved the last decade is Docker solved the last decade is portability. How do we get software from portability. How do we get software from portability. How do we get software from a laptop to the cloud? a laptop to the cloud? a laptop to the cloud? We're taking all of that experience and We're taking all of that experience and We're taking all of that experience and building a runtime and evolving that to building a runtime and evolving that to building a runtime and evolving that to now solve for safety. You still need now solve for safety. You still need now solve for safety. You still need portability, but you need safety, and portability, but you need safety, and portability, but you need safety, and you need this runtime to run across all you need this runtime to run across all you need this runtime to run across all environments. environments. environments. Um that's what we're focused on now. Um that's what we're focused on now. Um that's what we're focused on now. This is a new It starts with a brand new This is a new It starts with a brand new This is a new It starts with a brand new VM technology, and on top of that VM technology, and on top of that VM technology, and on top of that uh a bunch of advancements on MCP and uh a bunch of advancements on MCP and uh a bunch of advancements on MCP and policy and safety and governance. So, policy and safety and governance. So, policy and safety and governance. So, I'm going to show you a quick demo. Uh I'm going to show you a quick demo. Uh I'm going to show you a quick demo. Uh let's see if I can get this done in let's see if I can get this done in let's see if I can get this done in time. time. time. Also, you'll have to bear with me for a Also, you'll have to bear with me for a Also, you'll have to bear with me for a minute while I figure out minute while I figure out minute while I figure out how to do this here. how to do this here. how to do this here. Let's see. I had this figured out. I had this figured out. Up. Up. Up. Uh Uh Uh Let's just do that.

Do you guys see that? Cool. Do you guys see that? Cool. All right. So, All right. So, All right. So, is that visible? is that visible? is that visible? You'll see that? Cool. All right. I'm You'll see that? Cool. All right. I'm You'll see that? Cool. All right. I'm going to type over here. We'll see if going to type over here. We'll see if going to type over here. We'll see if this works. So, oops. this works. So, oops. this works. So, oops. Give me a minute. Let's start really basic. Let's start really basic. So, what we Oh my god. I'm there. I'm there. Cool. Um just to orient you all, so Cool. Um just to orient you all, so Cool. Um just to orient you all, so you've got a new tool called SPX. Want you've got a new tool called SPX. Want you've got a new tool called SPX. Want to guess what it stands for? This is to guess what it stands for? This is to guess what it stands for? This is This runs with a new micro VM that runs This runs with a new micro VM that runs This runs with a new micro VM that runs across all environments, Windows, Mac, across all environments, Windows, Mac, across all environments, Windows, Mac, Linux, cloud, everywhere. Uh let's start Linux, cloud, everywhere. Uh let's start Linux, cloud, everywhere. Uh let's start simple just so you can see this. Let's simple just so you can see this. Let's simple just so you can see this. Let's say I just do something like let's give say I just do something like let's give say I just do something like let's give this a name. And we'll create something. this a name. And we'll create something. this a name. And we'll create something. We'll say Codex We'll say Codex We'll say Codex test one test one test one codex.dat. Great. Just like that, this codex.dat. Great. Just like that, this codex.dat. Great. Just like that, this is going to go spin up is going to go spin up is going to go spin up a codex for me in a sandbox that's a codex for me in a sandbox that's a codex for me in a sandbox that's running running running um with my credentials injected in and um with my credentials injected in and um with my credentials injected in and with the network controls injected in. with the network controls injected in. with the network controls injected in. So, just as a test, I can do tell me a So, just as a test, I can do tell me a So, just as a test, I can do tell me a joke and as you can see this works.

joke and as you can see this works. joke and as you can see this works. And hopefully it tells me something And hopefully it tells me something And hopefully it tells me something funny. And I can also say funny. And I can also say funny. And I can also say um um um what credentials what credentials what credentials do you have do you have do you have access to and are they access to and are they access to and are they real or stubs? GitHub and GitHub and codex creds. Ignore my typos. codex creds. Ignore my typos. codex creds. Ignore my typos. Um I'll wait a minute for that to run, Um I'll wait a minute for that to run, Um I'll wait a minute for that to run, but just to describe this, the base but just to describe this, the base but just to describe this, the base environment here is got a sandbox environment here is got a sandbox environment here is got a sandbox running. This looks like a normal agent. running. This looks like a normal agent. running. This looks like a normal agent. You get the DX you you're used to, but You get the DX you you're used to, but You get the DX you you're used to, but this is running in a safe environment this is running in a safe environment this is running in a safe environment now for you. No credentials are there. now for you. No credentials are there. now for you. No credentials are there. They're all injected in. Network policy They're all injected in. Network policy They're all injected in. Network policy is controlled. And you'll see later you is controlled. And you'll see later you is controlled. And you'll see later you can control MCT. You can control a lot can control MCT. You can control a lot can control MCT. You can control a lot more here. more here. more here. All right. Um I'm just going to ask you All right. Um I'm just going to ask you All right. Um I'm just going to ask you to believe me so we can save some time. to believe me so we can save some time. to believe me so we can save some time. This will come back and say all the This will come back and say all the This will come back and say all the creds are there, but they're all stubs. creds are there, but they're all stubs. creds are there, but they're all stubs. And they're all just being injected in. And they're all just being injected in. And they're all just being injected in. Uh this takes some time, so I'm going to Uh this takes some time, so I'm going to Uh this takes some time, so I'm going to escape out for this. Okay, so now um escape out for this. Okay, so now um escape out for this. Okay, so now um let's let's work through use case. Let's let's let's work through use case. Let's let's let's work through use case. Let's say I want to review a PR and I want to say I want to review a PR and I want to say I want to review a PR and I want to write that summary into a Notion page. write that summary into a Notion page. write that summary into a Notion page. Well, I can break this down. I don't Well, I can break this down. I don't Well, I can break this down. I don't need a single monolithic sandbox where I need a single monolithic sandbox where I need a single monolithic sandbox where I give it both credentials. I can have one give it both credentials. I can have one give it both credentials. I can have one task to do the PR, write it down. I can task to do the PR, write it down. I can task to do the PR, write it down. I can have a separate sandbox with just Notion have a separate sandbox with just Notion have a separate sandbox with just Notion access, no other network access to take access, no other network access to take access, no other network access to take that and write it up. This could be a that and write it up. This could be a that and write it up. This could be a good way to break it down. So, let's good way to break it down. So, let's good way to break it down. So, let's just do that manually so we get a feel just do that manually so we get a feel just do that manually so we get a feel for it.

for it. for it. Um Um Um So, So, So, uh uh uh I'm going to just pull this over. So, I'm going to create So, I'm going to create a sandbox here. I'll give it a name. I a sandbox here. I'll give it a name. I a sandbox here. I'll give it a name. I have got a killed a kit uh a skill that have got a killed a kit uh a skill that have got a killed a kit uh a skill that tells it how to do the PR and go ahead tells it how to do the PR and go ahead tells it how to do the PR and go ahead and do that. and do that. and do that. And while that's going, this So, that's created. Um just so you get a So, that's created. Um just so you get a sense. sense. sense. We can look at the policies here. We can look at the policies here. We can look at the policies here. Um that was my PR bot and as you can see Um that was my PR bot and as you can see Um that was my PR bot and as you can see it's got access to GitHub and Anthropic it's got access to GitHub and Anthropic it's got access to GitHub and Anthropic and that's it. Nothing else. I can't and that's it. Nothing else. I can't and that's it. Nothing else. I can't have I can't go anywhere else now. have I can't go anywhere else now. have I can't go anywhere else now. Um Um Um and actually just to make sure I'm going and actually just to make sure I'm going and actually just to make sure I'm going to give this more access. I already give to give this more access. I already give to give this more access. I already give it that. Great. So, let's just run it. Great. This will run and now I can tell Great. This will run and now I can tell it go research this PR and it'll go off it go research this PR and it'll go off it go research this PR and it'll go off and do the work and write a summary. All and do the work and write a summary. All and do the work and write a summary. All right, just to save us time, I'd already right, just to save us time, I'd already right, just to save us time, I'd already done this.

done this. done this. So, now imagine this run. I can create another one here where I'll I can create another one here where I'll say this time I'm going to use Codex. say this time I'm going to use Codex. say this time I'm going to use Codex. And if you look here, I'm creating And if you look here, I'm creating And if you look here, I'm creating another sandbox. I'm giving this access another sandbox. I'm giving this access another sandbox. I'm giving this access to the Notion MCP. So, this is now an to the Notion MCP. So, this is now an to the Notion MCP. So, this is now an example of me containing it and giving example of me containing it and giving example of me containing it and giving scoped access just to what it needs. scoped access just to what it needs. scoped access just to what it needs. And this is not going to get access. And this is not going to get access. And this is not going to get access. I've I created this one, so assume I I've I created this one, so assume I I've I created this one, so assume I recreated it." recreated it." recreated it." And this one And this one And this one gets access to just those things. It gets access to just those things. It gets access to just those things. It doesn't have access to GitHub anymore doesn't have access to GitHub anymore doesn't have access to GitHub anymore over here. And now I can run this, and over here. And now I can run this, and over here. And now I can run this, and there I am, and I can tell it go do there I am, and I can tell it go do there I am, and I can tell it go do work. So, hopefully the idea you're getting is So, hopefully the idea you're getting is we get these sandboxes that can be we get these sandboxes that can be we get these sandboxes that can be composed and scoped down to the access composed and scoped down to the access composed and scoped down to the access they need. All right. Uh this is going they need. All right. Uh this is going they need. All right. Uh this is going to run. It'll do the right thing. It'll to run. It'll do the right thing. It'll to run. It'll do the right thing. It'll find the MCP tool and do all that. We'll find the MCP tool and do all that. We'll find the MCP tool and do all that. We'll save time there. Just trust you know, save time there. Just trust you know, save time there. Just trust you know, trust me. All right. trust me. All right. trust me. All right. So, So, So, great. Let's escape that, too, while great. Let's escape that, too, while great. Let's escape that, too, while that's running. that's running. that's running. Okay. So, this is great. I've got this Okay. So, this is great. I've got this Okay. So, this is great. I've got this now. But, you know what would be great now. But, you know what would be great now. But, you know what would be great is is is um um um I had created this thing. Well, can I I had created this thing. Well, can I I had created this thing. Well, can I just put this in the cloud?

just put this in the cloud? just put this in the cloud? Let's find out. That'd be nice if my Let's find out. That'd be nice if my Let's find out. That'd be nice if my runtime just extends. runtime just extends. runtime just extends. Uh like sure. Uh like sure. Uh like sure. Uh I already created that, so give me Uh I already created that, so give me Uh I already created that, so give me I'm just going to give it a different I'm just going to give it a different I'm just going to give it a different name. name. name. Just Just Just um um um just bear with there. So, cool. That ran, and can I just go in So, cool. That ran, and can I just go in there? Uh Uh what did I do? what did I do? what did I do? Up. Up. Up. Dash dash cloud, and Dash dash cloud, and Dash dash cloud, and great. great. great. Are you running Are you running Are you running on the cloud or on a Mac? on the cloud or on a Mac? on the cloud or on a Mac? This might take a while for it to debug This might take a while for it to debug This might take a while for it to debug it all come down. But, this now took it it all come down. But, this now took it it all come down. But, this now took it this feels the same, this feels the same, this feels the same, but the exact same sandbox just runs in but the exact same sandbox just runs in but the exact same sandbox just runs in the cloud cuz the runtime is portable the cloud cuz the runtime is portable the cloud cuz the runtime is portable and goes there with your policies and goes there with your policies and goes there with your policies applied, with all your controls applied. applied, with all your controls applied. applied, with all your controls applied. So, the same policy plane, same control So, the same policy plane, same control So, the same policy plane, same control continues with you and extends.

continues with you and extends. continues with you and extends. Um all right. I'm going to let this be Um all right. I'm going to let this be Um all right. I'm going to let this be great. It figured it out. It's running great. It figured it out. It's running great. It figured it out. It's running in the cloud. in the cloud. in the cloud. If I have the cloud, well, it'd be nice If I have the cloud, well, it'd be nice If I have the cloud, well, it'd be nice if I could if I could if I could do a lot of work with it and it fan out. do a lot of work with it and it fan out. do a lot of work with it and it fan out. So, there's a little script that goes So, there's a little script that goes So, there's a little script that goes tries to review six PRs, tries to review six PRs, tries to review six PRs, creates It's going to clean up that I creates It's going to clean up that I creates It's going to clean up that I run this before right before this. run this before right before this. run this before right before this. Create six sandboxes and runs them all Create six sandboxes and runs them all Create six sandboxes and runs them all in parallel. So, this is the power where in parallel. So, this is the power where in parallel. So, this is the power where you get the score same experience you you get the score same experience you you get the score same experience you have locally in the cloud with the same have locally in the cloud with the same have locally in the cloud with the same secure runtime secure runtime secure runtime uh and the same policy and scoped access uh and the same policy and scoped access uh and the same policy and scoped access running. So, this is going to run all running. So, this is going to run all running. So, this is going to run all six running in parallel. This is great. six running in parallel. This is great. six running in parallel. This is great. Uh I'm going to save us time and come Uh I'm going to save us time and come Uh I'm going to save us time and come out of that. out of that. out of that. Assume they all run. Assume they all run. Assume they all run. Um Um Um let me skip. Cool. let me skip. Cool. let me skip. Cool. Um Um Um Well, if I have Well, if I have Well, if I have I'll let that be for a minute. While that's running, if I can do cloud, While that's running, if I can do cloud, well, it'd be really nice well, it'd be really nice well, it'd be really nice if I can orchestrate. Let's see if I can if I can orchestrate. Let's see if I can if I can orchestrate. Let's see if I can do that.

do that. do that. Nope, that's my slide. Talk, excuse me. Great. Great. So, what if I can now do actual So, what if I can now do actual So, what if I can now do actual orchestration? So, if this is a orchestration? So, if this is a orchestration? So, if this is a an orchestration tool we have, you see an orchestration tool we have, you see an orchestration tool we have, you see the same bots here, the Notion one and the same bots here, the Notion one and the same bots here, the Notion one and PR one. PR one. PR one. And we have this orchestrator that knows And we have this orchestrator that knows And we have this orchestrator that knows how to orchestrate. how to orchestrate. how to orchestrate. Um Um Um can I come here can I come here can I come here and tell it Uh where's my cursor? Can I come and Uh where's my cursor? Can I come and tell it tell it tell it find 10 random find 10 random find 10 random PRs PRs PRs from and review them from and review them from and review them and and and write a summary to Notion. write a summary to Notion. write a summary to Notion. So, this will take some time. I'll just So, this will take some time. I'll just So, this will take some time. I'll just briefly show you what it's doing. This briefly show you what it's doing. This briefly show you what it's doing. This is the same runtime with the same is the same runtime with the same is the same runtime with the same control plane, with the same policy and control plane, with the same policy and control plane, with the same policy and scoped access, but now scaled out to scoped access, but now scaled out to scoped access, but now scaled out to orchestration and running. This will go orchestration and running. This will go orchestration and running. This will go off, it finds those agents, it'll off, it finds those agents, it'll off, it finds those agents, it'll schedule them, it'll compose over them, schedule them, it'll compose over them, schedule them, it'll compose over them, run PR with just a PR bot limited run PR with just a PR bot limited run PR with just a PR bot limited access, and then run the notion one with access, and then run the notion one with access, and then run the notion one with just a notion tool. This goes off and just a notion tool. This goes off and just a notion tool. This goes off and does work. And once I have this, you can does work. And once I have this, you can does work. And once I have this, you can do more things. You can create a do more things. You can create a do more things. You can create a schedule and schedule all that. So, we schedule and schedule all that. So, we schedule and schedule all that. So, we go from go from go from a runtime that's providing us scope like a runtime that's providing us scope like a runtime that's providing us scope like containment for just the task you need containment for just the task you need containment for just the task you need with scoped access, and the same thing with scoped access, and the same thing with scoped access, and the same thing follows you locally to the cloud to full follows you locally to the cloud to full follows you locally to the cloud to full orchestration.

orchestration. orchestration. All right. Last thing. Um where is Um where is uh uh uh There you go. Okay. There you go. Okay. There you go. Okay. So, we said now we need So, we said now we need So, we said now we need um um um we need intent-based access. How do we we need intent-based access. How do we we need intent-based access. How do we manage this dynamically? This is still manage this dynamically? This is still manage this dynamically? This is still I'm showing you an early prototype we I'm showing you an early prototype we I'm showing you an early prototype we have internally, not built yet. have internally, not built yet. have internally, not built yet. Um Um Um let me fetch a PR here. Just give me Uh where Okay. So, what's happening here Uh where Okay. So, what's happening here is we're running On the left, you see an is we're running On the left, you see an is we're running On the left, you see an agent running in a sandbox. You see the agent running in a sandbox. You see the agent running in a sandbox. You see the main agent over here. main agent over here. main agent over here. This has access just Anthropic Claude, This has access just Anthropic Claude, This has access just Anthropic Claude, no GitHub. But now I tell it do a This agent in this sandbox is scope This agent in this sandbox is scope limited. It cannot do that. limited. It cannot do that. limited. It cannot do that. In this environment, we built an In this environment, we built an In this environment, we built an intent-based tool for it where it can intent-based tool for it where it can intent-based tool for it where it can ask the runtime and say, "Hey, I want to ask the runtime and say, "Hey, I want to ask the runtime and say, "Hey, I want to take this action."

take this action." take this action." What should happen? It says, "Oh, my What should happen? It says, "Oh, my What should happen? It says, "Oh, my network's blocked. Let me delegate and network's blocked. Let me delegate and network's blocked. Let me delegate and ask." And if you look here now, ask." And if you look here now, ask." And if you look here now, we created a scoped sub-sandbox we created a scoped sub-sandbox we created a scoped sub-sandbox that got access to GitHub, that got access to GitHub, that got access to GitHub, and the main one did not. So, we're and the main one did not. So, we're and the main one did not. So, we're running that. We decided that the intent running that. We decided that the intent running that. We decided that the intent made sense. The user query said, "Review made sense. The user query said, "Review made sense. The user query said, "Review this PR." So, it makes sense you want this PR." So, it makes sense you want this PR." So, it makes sense you want access to that, but I'm going to create access to that, but I'm going to create access to that, but I'm going to create a scoped sub-sandbox for you where you a scoped sub-sandbox for you where you a scoped sub-sandbox for you where you get that access, and the result comes get that access, and the result comes get that access, and the result comes back. And the same thing can expand and back. And the same thing can expand and back. And the same thing can expand and go from there. So, what we did manually go from there. So, what we did manually go from there. So, what we did manually can start happening automatically with can start happening automatically with can start happening automatically with judgment in person. If the PR suppose judgment in person. If the PR suppose judgment in person. If the PR suppose the text PR said, "I want you to now the text PR said, "I want you to now the text PR said, "I want you to now export this to pastebin.com." That would export this to pastebin.com." That would export this to pastebin.com." That would get rejected. And this is running at a get rejected. And this is running at a get rejected. And this is running at a base one-time layer, so runs across base one-time layer, so runs across base one-time layer, so runs across every agent, every model, every harness every agent, every model, every harness every agent, every model, every harness that you need. that you need. that you need. Okay. Okay. Okay. Um let's come back to our presentation Um let's come back to our presentation Um let's come back to our presentation if I can figure out how to do this. if I can figure out how to do this. if I can figure out how to do this. Let's see here. Let's see here. Let's see here. Great. So, just to recap, the core thing here is just to recap, the core thing here is to really unlock autonomy, we need to really unlock autonomy, we need to really unlock autonomy, we need safety. To succeed at safety, you have safety. To succeed at safety, you have safety. To succeed at safety, you have to do this across models, across to do this across models, across to do this across models, across harnesses. You need to provide harnesses. You need to provide harnesses. You need to provide a contained environment. You need to a contained environment. You need to a contained environment. You need to put that environment, you need to be put that environment, you need to be put that environment, you need to be able to add scoped capabilities to that able to add scoped capabilities to that able to add scoped capabilities to that environment. You need to be able to know environment. You need to be able to know environment. You need to be able to know what capabilities to provide there based what capabilities to provide there based what capabilities to provide there based on intent. And this one-time has to work on intent. And this one-time has to work on intent. And this one-time has to work across models, across harnesses, and across models, across harnesses, and across models, across harnesses, and move across all environments, local, move across all environments, local, move across all environments, local, cloud, VPC, orchestration.

cloud, VPC, orchestration. cloud, VPC, orchestration. That's what we focus on. That's what That's what we focus on. That's what That's what we focus on. That's what we're building. That's what we think is we're building. That's what we think is we're building. That's what we think is needed to actually go unlock agent needed to actually go unlock agent needed to actually go unlock agent autonomy next. Please go try this out. autonomy next. Please go try this out. autonomy next. Please go try this out. It's really easy. You can just go brew It's really easy. You can just go brew It's really easy. You can just go brew install SPX, run this. You can run install SPX, run this. You can run install SPX, run this. You can run Claude, Codex, Open Code, any agent, Claude, Codex, Open Code, any agent, Claude, Codex, Open Code, any agent, build your own in there. build your own in there. build your own in there. Um I'll be around afterwards, open for Um I'll be around afterwards, open for Um I'll be around afterwards, open for questions. And we have a booth uh down questions. And we have a booth uh down questions. And we have a booth uh down below. Come find us there, too. below. Come find us there, too. below. Come find us there, too. Thank you. Thank you. Thank you. >> [applause]